Cisco Secure Network Analytics

Creating the Format

To create a new log format, complete the following steps:

1. In your browser, access your Blue Coat proxy server.
2. Click the Configuration tab.
3. In the main menu of the Management Console, click Access Logging > Formats.
4. Click New at the bottom of the page. The Create Format page opens.
5. In the Format Name field, enter a name for the new format.
6. Select the W3C Extended Log File Format (ELFF) option.
7. In the format field, enter the following string: timestamp duration c-ip c-port r-ip r-port s-ip s-port cs-bytes sc-bytes cs-user cs-host cs-uri
8. Click OK. Continue to the next section, Create a New Log.

Create a New Log

To create the logs, complete the following steps:

1. In the main menu, click Access Logging > Logs, and then select the new log format. The Log page opens.
2. Click the General Settings tab.
3. From the Log Format drop-down list, select the log created in Step 1.
4. In the Description field, enter a description for your new log.
5. Click the Apply button at the bottom of the page. Continue to the next section, Configure the Upload Client.

Configure the Upload Client

To configure the upload client, complete the following steps:

1. Click the Upload Client tab. The Upload Client page opens.
2. From the Client type drop-down list, select Custom Client.
3. Click the Settings button. The Custom Client settings page opens.
4. In the appropriate fields, enter the IP address of the Flow Collector and the listening port of the proxy parser. Note: SSL is not supported at this time.
5. Click OK.
6. For the Transmission Parameters, complete these steps:
   • For the Encryption Certificate, select No encryption.
   • From the Signing Keyring drop-down list, select no signing.
   • From the "Save the log file as" option, select the Text file option.
   • In the "Send partial buffer after" text box, enter 5.
   • Click the Upload Schedule tab, and select the continuously option for uploading the access log.
   • In the Wait between connect attempts field, enter 60.
   • In the Time between keep-alive log packets field, enter 5.
7. Click the Apply button at the bottom of the page. Continue to the next section, Configuring the Upload Schedule.

Configuring the Upload Schedule

To configure the upload schedule, complete the following steps:

1. Click the Upload Schedule tab.
2. For "Upload the access log," select continuously.
3. Set "Wait between correct attempts" to 60 seconds.
4. Set "Time between keep-alive log packets" to 5 seconds.
5. Click the Apply button at the bottom of the page.

This completes the configuration for the Blue Coat proxy logs for the Flow Collector.

Configuring the McAfee Proxy Logs

Use this section to configure McAfee proxy logs from the McAfee Web Gateway to send to Secure Network Analytics.

• Ensure you have downloaded the XML configuration file for the McAfee proxy. Obtain the readme and Proxy Log XML configuration files from Cisco Software Central.
• Log in to your Cisco Smart Account at https://software.cisco.com or contact your administrator.
• The McAfee proxy version used for testing was 7.4.2.6.0 – 18721.

To set up the McAfee proxy log, complete the following steps:

1. Download the XML file, FlowCollector_[date]_McAfee_Log_XML_Config_[v].xml, and save it to your preferred location. The "Date" indicates the XML file's date, and "v" indicates the McAfee proxy version. Select the XML file matching your McAfee proxy's version number.
2. To download the file, follow these steps:
   • Go to https://software.cisco.com, Cisco Software Central.
   • Navigate to the Download and manage > Download and Upgrade section, then select Access downloads.
   • Scroll down to the Product field.
   • In the Select a Product field, type Secure Network Analytics and press Enter.
   • Select Secure Network Analytics Virtual Flow Collector or another Flow Collector.
   • Select Secure Network Analytics System Software > Configuration Files.
3. Log in to the McAfee proxy server.
4. Click the Policy icon, and then click the Rule Sets tab.
5. Select Log Handler, and then select Default.
6. Click Add > Rule Set from the Library.
7. Click Import from file, and then select the XML file.
8. Select mcafeelancopelog in the log handler that was just imported. Note: Ensure the rule set and the rule "create access logline" and "send to syslog" are enabled.
9. Click the Configuration icon at the top of the page.
10. On the left side of the page, click the File Editor tab, and then select the rsyslog.conf file.
11. At the bottom of the text box (beside the list of files), enter the following text: daemon.info @[FlowCollector IP Address:514]. Note: Ensure you select the Flow Collector that collects data from the exporters and endpoints you wish to investigate in the proxy logs.
12. Comment out the line: *.info;mail.none;authpriv.none;cron.none.
13. Add the following line: *.info;daemon.!=info;mail.none;authpriv.none;cron.none /var/log/messages.
14. Click the Save Changes button at the top right of the page.
15. Continue to the Configuring the Flow Collector section to set up your Flow Collector to receive syslog information.

Configuring Squid Proxy Logs

Use this section to configure Squid proxy logs to send to Secure Network Analytics. You can edit the files on the proxy server using SSH.

To configure the Squid proxy logs, complete the following steps:

1. Log into a shell for the machine running Squid.
2. Navigate to the directory containing squid.conf (typically /etc/squid) and open it in an editor.
3. Add the following lines to squid.conf to configure logging:

   logformat access_format %ts%03tu %<tt %>a %>p %>st %<A %<st %<la %<lp %la %lp %un %ru
   access_log syslog:user.6 access_format

4. Restart squid using one of the following commands:
   • For init based systems: /etc/init.d/squid3 restart
   • For systemd based systems: systemctl restart squid
5. Configure the syslog service on the Squid server to forward logs to the Flow Collector. This configuration depends on the Linux distribution and syslog service used.
   • For syslog-ng, add the following to /etc/syslog-ng/syslog-ng.conf:

     # Audit Log Facility BEGIN
     filter bs_filter { filter(f_user) and level(info) };
     destination udp_proxy { udp("10.205.14.15" port(514)); };
     log {
       source(s_all);
       filter(bs_filter);
       destination(udp_proxy);
     };
     # Audit Log Facility END

   • For rsyslog, add the following to /etc/rsyslog.conf:

     :programname, contains, "squid" @10.205.14.15:514

6. Restart the syslog service:
   • For init based systems: /etc/init.d/syslog-ng restart (for syslog-ng) or /etc/init.d/rsyslog restart (for rsyslog)
   • For systemd based systems: systemctl restart syslog (for syslog-ng) or systemctl restart rsyslog (for rsyslog)

   Note: Ensure you select the Flow Collector that collects data from the exporters and endpoints you wish to investigate in the proxy logs.

7. Continue to the Configuring the Flow Collector section to receive syslog information.

Configuring the Flow Collector

After configuring the proxy server, you need to configure the Flow Collector to accept the data.

To configure the Flow Collector to receive syslog information, complete the following steps:

1. Log in to your Manager.
2. Select Configure > Global > Central Management.
3. Click the ... (Ellipsis) icon for your Flow Collector, then click View Appliance Statistics.
4. Log in to the Flow Collector. The Flow Collector interface opens.
5. Click Configuration > Proxy Ingest. The Proxy Servers page opens.
6. Enter the IP address of the proxy server.
7. From the Proxy Type drop-down list, select your proxy server. Note: If your proxy server type is not listed, you will not be able to use proxy logs at this time.
8. If the Proxy Server:
   • has only one IP address, enter the proxy server's IP address in the IP Address field. Leave the Telemetry IP Address field empty.
   • has multiple IP addresses, enter the management IP address of the proxy server (syslog's message's source IP address) in the IP Address field. Enter the telemetry IP address of the proxy server in the Telemetry IP Address field.
9. In the Proxy Service Port field, enter the port number of the proxy server.
10. If you want the proxy server to trigger alarms, un-check the Exclude from Alarming check box.
11. Click Add.
12. Click Apply. The proxy server will appear in the Proxy Ingest table at the top of the page.
13. Continue to the Checking the Flows section.

Checking the Flows

To verify that you are receiving the flows, complete the following steps:

1. In the Flow Collector interface, click Support > Browse Files in the main menu. The Browse Files page opens.
2. Open the sw.log file.
3. Check that the webproxy count is increasing to confirm that you are receiving data.

Contacting Support

If you require technical support, please do one of the following:

• Contact your local Cisco Partner
• Contact Cisco Support
• To open a case via the web: http://www.cisco.com/c/en/us/support/index.html
• For phone support (U.S.): 1-800-553-2447
• For worldwide support numbers: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html

Change History

Copyright Information

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)